MTG Spellbook · Privacy policy
MTG Spellbook sends me nothing — no analytics, no accounts, no personal information, ever. The one exception is one you can create yourself: if you connect your own Mana Pool shop to the selling feature (in beta), the app sends your Mana Pool sign-in to Mana Pool. The rest of this page is the detail.
Stored on your iPhone
Everything you put into MTG Spellbook — your card collection, your saved decks, your collection value history, your life counter games, and your settings — is stored in the app's own storage on your iPhone.
MTG Spellbook has no accounts, no sign-in, and no way to identify you.
Optional · Off unless you switch it on
If you turn on iCloud sync, MTG Spellbook copies three files — your collection, your saved decks, and your value history — into your own private iCloud Drive storage, so your other devices can read them. This is off unless you switch it on.
Those files go to Apple's iCloud under your own Apple ID. They are not sent to me, and I have no access to them and no server of my own. Apple's handling of iCloud data is covered by Apple's privacy policy. Turning sync off stops any further copying; you can remove the files themselves in the Files app under iCloud Drive.
Handled entirely by Apple
MTG Spellbook offers a single one-time in-app purchase that removes the free version's limits. The purchase is handled entirely by Apple. I never see your name, your payment details, or your Apple ID — the app only ever asks Apple "has this device's Apple ID bought this?" and gets back yes or no.
Card data only · Never anything about you
MTG Spellbook needs card information, so it makes requests to the following services. None of these requests contains anything about you — only the name of a card or a search term. (Connecting a Mana Pool shop for selling is different, and has its own section below.)
Scryfall (api.scryfall.com, cards.scryfall.io) — the free public Magic: The Gathering card database. MTG Spellbook asks it for card rules text, prices, and card images. Scryfall's own privacy policy is at scryfall.com/docs/privacy-policy.
Commander Spellbook (backend.commanderspellbook.com) — a free public database of card combinations, used to check whether a deck contains an unintended two-card combo. Its privacy policy is at commanderspellbook.com/privacy-policy.
A card list address you choose — if, and only if, you enter a web address in Settings, MTG Spellbook will fetch that file. This is off by default and is blank unless you fill it in yourself.
MTG Spellbook contains no analytics, no crash reporting, no advertising, and no third-party tracking software of any kind. Nothing you do in the app is measured or reported.
Opt-in · Only if you sell · Beta
MTG Spellbook has an optional selling feature, currently in beta, for people who run their own shop on Mana Pool. It does nothing until you connect it yourself.
If you do connect it, the app sends your Mana Pool account email and access token to Mana Pool, and nowhere else, to sign its requests — the same credentials you created in your own Mana Pool account settings. They are stored in your iPhone's Keychain, and disconnecting the shop deletes them from it. They are never sent to me; I still have no server.
What the app exchanges with Mana Pool is shop data: the listings, prices and quantities of the one binder or box you nominate as your sale shelf, and what your shop already stocks. Nothing about your decks, and nothing about the rest of your collection, is ever sent. The in-app diagnostics record strips out both the email and the token.
Mana Pool's own handling of your seller account is covered by Mana Pool's privacy policy.
On-device only · Never saved
MTG Spellbook asks for camera access only for the card scanner, and only while that screen is open.
The camera is used to read the text printed on a card, using Apple's Vision framework, which runs entirely on your device. No photograph or video frame is ever saved, uploaded, or sent anywhere — not to me, not to anyone. Once a frame has been read it is discarded.
What leaves your device is the same thing that would leave it if you typed the card name in by hand: a card name, or a set code and collector number, sent to Scryfall to look the card up.
You can decline camera access and every other part of MTG Spellbook keeps working.
Children
MTG Spellbook collects no data from anyone, including children under 13.
Changes to this policy
If this policy changes, the updated version will be posted at this address and the date at the top will change.
Questions about this policy can be sent to msw1382@gmail.com. There's no support queue and no ticket number — email goes straight to me, and I answer it.
— Matthew Wall